YouTube AI Videos
PassAudited by ClawScan on May 1, 2026.
Overview
This skill is coherent and appears benign; it fetches YouTube video metadata using a YouTube API key, so users should protect that key and expect Google/YouTube network requests.
This looks safe for its stated purpose. Before installing, create a restricted YouTube Data API v3 key, store it in the environment or OpenClaw secrets file rather than config.json, and review config.json if you want to change which channels and keywords are queried.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The skill can use your YouTube Data API quota and relies on a local credential you provide.
The skill requires a YouTube Data API key. That credential use is purpose-aligned and disclosed, but users should protect the key and avoid the plain-text config fallback when possible.
The API key can be provided in three ways (priority order): 1. Environment variable: `YOUTUBE_API_KEY` 2. Secrets file: `~/.openclaw/secrets/youtube_api_key.txt` 3. Config file: `config.json`
Use a YouTube API key restricted to YouTube Data API v3, store it in the environment or OpenClaw secrets file, and leave config.json as a placeholder.
When invoked, the skill contacts Google/YouTube and sends the API key as part of the API request to fetch channel and video metadata.
The script makes outbound YouTube Data API requests using the provided key. This matches the skill purpose and is limited to configured channels.
videos_url = f"https://www.googleapis.com/youtube/v3/search?part=snippet&channelId={channel_id}&order=date&type=video&maxResults=25&key={api_key}"Only install if you are comfortable with those external API calls, and review config.json to ensure the channel list and limits are what you want.
A user relying only on registry metadata might not realize the skill needs a YouTube API key before installation or first use.
The registry metadata does not declare the YouTube API key requirement that SKILL.md and the script disclose. This is an under-declared setup contract, not hidden runtime behavior.
Required env vars: none; Env var declarations: none; Primary credential: none
Read the SKILL.md/README setup section before use and treat the API key as a required credential despite the registry metadata.